Types of vulnerabilities

A vulnerability is a weakness a threat can exploit. This objective spans application flaws (memory and injection bugs, race conditions, malicious updates), operating system and web flaws, hardware and firmware, virtualization, cloud, supply chain, cryptographic weaknesses, misconfiguration, mobile, and zero-day vulnerabilities.

Application vulnerabilities

Time-of-check to time-of-use (TOCTOU) is a race condition where a program checks a condition, such as file permissions, then acts later; an attacker swaps the file in between. Injection flaws happen whenever data is treated as code: SQL, LDAP, command, and XML injection all share the root cause.

Hardware, virtualization, and cloud

Firmware flaws live below the operating system and survive reinstalls. End-of-life hardware no longer gets firmware fixes, and legacy hardware may not support modern security features at all. In virtualization, VM escape lets code break out of a guest to the hypervisor, and resource reuse can leak data if memory or disk isn't cleared between tenants. In the cloud, the biggest category is misconfiguration: public storage buckets, overly broad roles, and unrestricted security groups.

Crypto, configuration, mobile, and zero-day

Cryptographic vulnerabilities include weak or deprecated algorithms, short keys, poor random number generation, and certificate problems such as expired or self-signed certificates. Misconfiguration covers default settings, unnecessary services, excessive permissions, and verbose error messages. Mobile devices add side loading (installing apps outside the official store) and jailbreaking or rooting, which removes the OS's built-in protections.

A zero-day vulnerability is one the vendor doesn't yet know about or hasn't fixed, so no patch exists. Defenses are layered: least privilege, segmentation, behavior-based detection, and fast incident response.

Key terms

Buffer overflow

Writing more data into a memory buffer than it holds, overwriting adjacent memory and possibly running code.

Memory injection

Inserting malicious code into the memory of a running legitimate process.

Race condition

A flaw where the outcome depends on the timing of events that the program doesn't control.

Time-of-check to time-of-use (TOCTOU)

A race condition where a resource changes between the moment it's checked and the moment it's used.

Malicious update

A software update delivered through a trusted channel that contains malware.

SQL injection (SQLi)

Inserting database commands through user input that an application adds to a query unsafely.

Cross-site scripting (XSS)

Injecting script into a web page so it runs in other users' browsers.

Firmware vulnerability

A flaw in the low-level software built into hardware, which persists across operating system reinstalls.

Virtual machine (VM) escape

Breaking out of a guest virtual machine to reach the hypervisor or other guests.

Resource reuse

Data leaking between tenants because memory or storage isn't cleared before reassignment.

Cloud misconfiguration

Insecure cloud settings, such as public storage or overly broad permissions, set by the customer.

Side loading

Installing mobile apps from outside the official app store, bypassing its review.

Jailbreaking

Removing the manufacturer's restrictions on a mobile operating system to gain full control.

Zero-day vulnerability

A flaw that is unknown to the vendor or has no available patch when attackers exploit it.